FAIR

Federated and Independent Repositories

Mimic Guard

Plugin Banner

Mimic Guard

by aoto

Download
Description

Mimic Guard is an anti-spam plugin for WordPress mail and contact forms. It uses dynamic honeypots, submission time monitoring, and integration with major form plugins to reduce automated bot submissions.

  • Honeypot — Detects bots that fill hidden form fields
  • Time check — Flags submissions that are unrealistically fast after the form is shown
  • Form integration — Works with WPForms, Contact Form 7, comments, and more
  • Page caching — Optional AJAX honeypot injection when HTML is cached
  • URL filter — Optional blocking when the message body contains http(s) URLs
  • Restricted fields — Blocks URL, www, mailto, and @ patterns in name-like fields (not the message body or email inputs)
  • Privacy — Optional IP anonymization when logging events
  • Interaction check — Optional minimum focus/keyboard activity before submit
  • Origin check — Optional blocking when Origin/Referer does not match your site
  • Rate limit fingerprint — Optional per-browser counting when rate limiting is on

Configure minimum submission time, token lifetime, log list size, and more from the admin screens.

  1. Upload the plugin folder to /wp-content/plugins/mimicguard/ or install from the ZIP file.
  2. Activate Mimic Guard on the Plugins screen in WordPress.
  3. Open the Mimic Guard menu to review settings and logs.
I use a full-page caching plugin

Enable “Insert honeypot via AJAX (cache-friendly)” so honeypots can still be loaded even when HTML is cached.

Legitimate submissions are being blocked

Try increasing the minimum submission time slightly, or disable “Require time-check token” if you do not need it.

Where are logs stored?

In a dedicated database table. You can run cleanup from the admin area based on retention settings.

1.4.0

Optional interaction check, Origin/Referer validation, and browser fingerprint support for rate limiting (all off by default).

1.3.5

Block URL and email-like patterns in non-message form fields (for example name or phone fields). Message body and email fields are excluded; optional message-body URL blocking is unchanged.

1.3.4

Added optional blocking when the message body contains an http:// or https:// URL. Confirmed compatibility with WordPress 7.0.

1.3.3

Reduced honeypot false positives from browser/password manager autofill by hardening honeypot field attributes and narrowing dynamic prefix checks; also improved detailed block reason logging and frontend guard checks.

1.3.0

Internal improvements, security, and code quality updates.

Back to top